CVE-2015-7450

Опубликовано: 02 янв. 2016

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Критический

Описание

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg21970575
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971342
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971376
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971733
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21971758
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21972799
Vendor Advisory
http://www.securityfocus.com/bid/77653
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035125
Broken Link
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/41613/
Exploit
Third Party Advisory
VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg21970575
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971342
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971376
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971733
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21971758
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21972799
Vendor Advisory
http://www.securityfocus.com/bid/77653
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035125
Broken Link
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/41613/
Exploit
Third Party Advisory
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7450

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:sterling_b2b_integrator:5.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:sterling_integrator:5.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:tivoli_common_reporting:2.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:tivoli_common_reporting:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:tivoli_common_reporting:2.1.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:tivoli_common_reporting:3.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:tivoli_common_reporting:3.1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:tivoli_common_reporting:3.1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:tivoli_common_reporting:3.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:tivoli_common_reporting:3.1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:watson_content_analytics:*:*:*:*:*:*:*:*

Версия от 3.0 (включая) до 3.0.0.6 (включая)

cpe:2.3:a:ibm:watson_content_analytics:*:*:*:*:*:*:*:*

Версия от 3.5 (включая) до 3.5.0.3 (включая)

cpe:2.3:a:ibm:watson_explorer_analytical_components:*:*:*:*:*:*:*:*

Версия от 10.0 (включая) до 10.0.0.2 (включая)

cpe:2.3:a:ibm:watson_explorer_analytical_components:11.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:watson_explorer_annotation_administration_console:*:*:*:*:*:*:*:*

Версия от 10.0 (включая) до 10.0.0.2 (включая)

cpe:2.3:a:ibm:watson_explorer_annotation_administration_console:11.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:7.0.0.0:*:*:*:-:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.0:*:*:*:-:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:traditional:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:*:*:*:hypervisor:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.5.5:*:*:*:liberty:*:*:*

EPSS

Процентиль: 100%

0.93487

Критический

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-8987-qgc7-79p9

CVSS3: 9.8

github

больше 3 лет назад

BDU:2016-00358

fstec

около 10 лет назад

Уязвимость средства централизованного сбора и анализа данных IBM Tivoli Common Reporting, позволяющая нарушителю выполнить произвольные команды